# The state of affairs: what changed between v0 and v1

> Story: written here by this site, signed and dated. By the journalist.

The measures and the text of the state of affairs, v0 against v1.

View · the state of affairs · what changed

# What changed between v0 and v1

From 22 October 2026, 11:34 UTC to 23 October 2026, 14:11 UTC: 12 of 14 measures changed, and the text gained 37 lines and lost 3.

**v0** site v0.2.5 · evidence vault `200d08971937` · NCSC-NL inventory `cca173c64ec5` · data as of 22 October 2026, 11:34 UTC **v1** site v0.10.1 · evidence vault `f3c5db0d9873` · source watch `c26dce84136f` · NCSC-NL inventory `2fdc314ded28` · data as of 23 October 2026, 01:20 UTC

[← v0 in full](../v0/index.html) · [v1 in full →](../v1/index.html) · [every version](../history/index.html)

## The measures, side by side

| Measure | v0 | v1 |  |
|---|---|---|---|
| **Organisations confirming a compromise through php2shell** | 0 | 0 | unchanged |
| **Named incidents whose link to php2shell is still open** | 0 | 3 open, 1 ruled out | **changed** |
| **Of the two CVEs in CISA's Known Exploited Vulnerabilities catalog** | 0 | 0 | unchanged |
| **NIST's own score in the National Vulnerability Database** | none yet; the CNA's CVSS 4.0 9.2 only | CVSS 3.1 9.8 (Analyzed), beside the CNA's CVSS 4.0 9.2 | **changed** |
| **EPSS: chance of exploitation activity in the next 30 days** | not tracked | 0.058 and 0.053, about the 93rd percentile for both | **changed** |
| **Public GitHub repositories matching 'php2shell'** | not tracked | 735 (586 at 17:51 UTC on 22 October) | **changed** |
| **Merged Metasploit modules naming php2shell** | not tracked | 0 | **changed** |
| **NCSC-NL inventory: products fixed, of all listed** | 46 of 674 | 109 of 751 | **changed** |
| **NCSC-NL inventory: products still under investigation** | 418 | 389 | **changed** |
| **Security and network vendors' products confirmed vulnerable** | not counted | 10 vulnerable, 26 not, 16 under investigation | **changed** |
| **PHP servers that disclose their version running an end-of-life branch** | not known | about 758,000 of 1.1 million | **changed** |
| **Sites that went dark over php2shell, and how many are still dark** | 10 operators reported offline | 51 listed, 50 back, 1 still dark (French prefecture websites) | **changed** |
| **National authorities saying they know of no successful exploitation in their country** | 2 (CISA for the US, ACSC for Australia) | 5 (adding Germany's BSI, Switzerland's BACS and Japan's government) | **changed** |
| **Sources in the evidence vault, and the latest capture** | 144, latest capture 22 Oct 11:34 UTC | 227, latest capture 23 Oct 01:20 UTC | **changed** |

## The text, line by line

Removed lines are struck through, added lines are marked; within an edited line, the words that changed.
## The lineTwophp2shell criticalis flawsa severe flaw that, two days after its release, still has no confirmed victim. The story has moved from the bug to the second stories: who is still exposed, who ships the fix, and what the devices in front of servers are made of. The evidence for every line below is in the PHPevidence enginevault, werenow fixedrefreshed onto 21227 October, after a disclosure that leaked two days early. The alarm was loudsources, and the evidence of harm was thin: governments and others took sites offline as a precaution, a CDN counted exploit attempts in the millions,source andwatch's nodated organisation had confirmed a compromise. [[x-eastdakota-php2shell-stats, rijksoverheid-ncsc-php-news, cisa-kev-json]]series.## WhatCompromise: thisstill versionnone isconfirmed, three cases openThis version was not written on 22 October. It is rebuilt from the site at v0.2.5, whose data were exported from the evidence vault at commit 200d08971937, and from the journalist's story of that day, [Where php2shell stands](/articles/where-php2shell-stands/index.html). Its measures are the ones that story and the site's pages gave; where the site did not yet track something, the measure says so.No named organisation has confirmed a compromise through php2shell. As the researcher's evidence page puts it, that is "a time-bounded absence, not a confirmed fact": true as of the last check, and one statement would end it; the rows behind it are on [the compromise evidence page](/compromise/index.html). The PHP Foundation knows of no successful remote code execution; Dataminr sees scanning, fingerprinting and non-working exploits. [[wired-exploited-days-before-patched, bleepingcomputer-amazon-4-days-before]] Four named incidents have been linked to php2shell in the press, and none holds yet.- **Valtec** in Japan blamed the PHP flaw for a service halt, then corrected itself the same day: the flaw was in its own service. Ruled out. [[impress-watch-valtec]]- **ČVUT**, the Czech Technical University, says it stopped an attack that it calls part of the worldwide attempts against PHP sites. That is an attack, in the organisation's words, not a confirmed compromise. Open. [[lupa-cvut-cyber-attack]]- **GMO**'s FX trading VPS service found unauthorised programs on some servers on 20 October, the day of the leak and before the release; up to 26,739 servers may be affected. GMO names no cause. Open, and timing is not attribution. [[yahoo-jp-gmo-fx-login-leak]]- **DMM** halted services for a vulnerability "in external software" and will not confirm PHP. Open. [[sankei-dmm-service-halt]]One more claim is unverified: a startup owner told Fortune that source code was stolen through the bug. [[fortune-ai-tools-php-vulnerability]] Patchstack says hosting partners reported "multiple active exploitation incidents" before the release, without naming any. [[recordedfuture-php2shell]] Headlines in WIRED and The Verge say "exploited"; their bodies describe attempts. [[wired-exploited-days-before-patched, the-verge-php2shell-websites-down]]## Exploitation and weaponisationAttempts are broad. Amazon calls it "broadly exploited in the wild" and adds that it is unclear whether any attempt would have worked; Hadrian says exploitation is at scale, mostly through PHP's session upload-progress mechanism; VulnCheck saw at least one Chinese IP address try, and fail, to deploy a webshell. [[securityweek-exploitation-days-before, the-register-hackers-pile-on-php2shell]] National authorities in Germany, Switzerland and Japan say, as reported, that they know of no successful exploitation, joining the US and Australia. [[rtl-leben-digitales-php-luecke-bsi-warnt-vor-cyber-gefahr-fi, watson-wirtschaft-schweiz-322033892-php2shell-laut-bund-kein, tchina-kyodonews-articles-15266, cisa-alert-php-20261021, acsc-alert-php]]The markers of weaponisation have not moved: neither CVE is in CISA's Known Exploited Vulnerabilities catalog at the last check, 08:03 UTC today, and no Metasploit module has been merged. [[cisa-kev-json]] EPSS puts the chance of exploitation activity in the next 30 days at about 5%, near the 93rd percentile. NIST has now analysed both records and added its own CVSS 3.1 score of 9.8 beside the PHP project's CVSS 4.0 9.2, so a reader will meet both numbers. [[nvd-cve-2026-109618, nvd-cve-2026-109619]] Public GitHub repositories matching "php2shell" went from 586 to 735 overnight; that is search results, not working exploits.## Patching: the fix is reaching servers, and the tail is end-of-lifeThe NCSC-NL inventory, read from its public history, had 109 of 751 products fixed at 12:50 UTC today, against 46 of 674 when the vault captured it yesterday morning; the pile under investigation fell from 418 to 389, and 30 products are now marked not affected. [[ncsc-nl-php2shell-software-list-letters]] The newly fixed include Azure App Service, AWS Elastic Beanstalk, SUSE, NixOS and Synology's PHP packages back to 7.4. The hour-by-hour curve is on [the inventory page](/patching/inventory/index.html).The tail is the number the patching story lacked yesterday. VirusTotal's analysis, as reported, finds about 5.1 million IPs running PHP; of the 1.1 million that disclose a version, about 758,000 run an end-of-life branch and about 272,000 a supported one. [[tugatech-t93092-milhoes-de-servidores-php-expostos-ao-risco, recordedfuture-php2shell]] Most of the exposed population is on versions the PHP project did not release a fix for.## The protection layer is in scopeTen products from security and network vendors are now marked vulnerable in the inventory: Palo Alto's PAN-OS and Panorama, Check Point's firewall web interfaces, NetScaler ADC and Gateway, two parts of F5's BIG-IP, Cisco's Expressway series and URWB, and Sophos's MyUTM portal. Palo Alto confirms PAN-OS 10.2 to 12.2 are affected through the management interface, with fixes pending and no exploitation known to it. [[paloalto-psirt-cve-2026-109618]] Cisco's advisory as captured on 22 October knew of no affected product; the inventory now marks three, which is a change over time, not a contradiction. [[cisco-sa-php-october26]]## Offline: almost everyone is backA community tracker lists 51 sites that went dark over php2shell; 50 are back, and French prefecture websites are the one still dark. [[phpocalypse-tracker-sites-csv]] The Dutch government's DigiD, MijnOverheid and Overheid.nl are back online. [[securitynl-misbruik-gemeld]]## What would change this state- A named organisation confirming a compromise, or GMO naming its cause.- A KEV listing, or a merged Metasploit module.- The 389 inventory rows under investigation resolving, and fixes for the security appliances.- A count of how many of the 758,000 end-of-life servers are reachable through the vulnerable path.


---
site v0.10.9 · data as of 2026-10-23T01:20Z · vault commit f3c5db0d9873 · https://php.oct.2026.newsroom.sgit.ai/views/state/v0-v1/index.html